Skip to content

Azure AD B2C throws auth_callback_error JWT not active yet #3067

New issue
New issue
Closed
Closed
Azure AD B2C throws auth_callback_error JWT not active yet#3067
Labels
providersquestionAsk how to do something or how something works
@dg-eparizzi

Description

@dg-eparizzi
dg-eparizzi
opened on Oct 29, 2021

Question 💬

I'm using this repo but commented out all providers and just set Azure AD B2C.

export default NextAuth({
  providers: [
    AzureB2CProvider({
      tenantId: process.env.AZURE_AD_B2C_TENANT_NAME,
      clientId: process.env.AZURE_AD_B2C_CLIENT_ID,
      clientSecret: process.env.AZURE_AD_B2C_CLIENT_SECRET,
      primaryUserFlow: process.env.AZURE_AD_B2C_PRIMARY_USER_FLOW,
      authorization: { params: { scope: "offline_access openid" } }, // btw, this is not explained properly in the documentation
    })
  ]
 // everything else equal to the example repo...
})

I have followed the basic configuration described here. Not sure if the Advanced is also needed or optional.

I've set my Azure AD B2C callback URL to http://localhost:3000/api/auth/callback/azure-ad-b2c

When I click Sign In with Azure AD B2C, I see in the network tab of my devtools that I'm indeed being redirected to my B2C tenant /authorize endpoint and then back to /api/callback/azure-ad-b2c with a state query string param.

The browser is redirected to /api/auth/error?error=OAuthCallback and the console shows the following (debug enabled).

[next-auth][debug][OAUTH_CALLBACK_PROTECTION] {
  state: '18e7f650b6217557a54f8759c7f3f087a3df1b8d7b8c3d7a44c0831d060a9694',   
  csrfToken: 'af9b2355283971f4ba4809f0c1e41fab417bc8cd1d50fb212ec30fa4a4afa051'
}
[next-auth][debug][GET_AUTHORIZATION_URL] {
  url: 'https://dgpav2dev.b2clogin.com/dgpav2dev.onmicrosoft.com/b2c_1_signupsignin1/oauth2/v2.0/authorize?client_id=0d3c674a-8aaf-41c0-8bad-36ebf325f59d&scope=offline_access%20openid&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fazure-ad-b2c&nextauth=signin%2Cazure-ad-b2c&state=18e7f650b6217557a54f8759c7f3f087a3df1b8d7b8c3d7a44c0831d060a9694'
}
[next-auth][debug][PROFILE_DATA] {
  OAuthProfile: {
    exp: 1635524073,
    nbf: 1635520473,
    ver: '1.0',
    iss: 'https://dgpav2dev.b2clogin.com/bd51fb4d-a1b4-42b2-a322-3e8d6a829dd3/v2.0/',
    sub: 'bca5df8c-2d64-47df-bdc1-201bd5be8146',
    aud: '0d3c674a-8aaf-41c0-8bad-36ebf325f59d',
    iat: 1635520473,
    auth_time: 1635520471,
    oid: 'bca5df8c-2d64-47df-bdc1-201bd5be8146',
    newUser: true,
    country: 'Spain',
    given_name: 'Emiliano',
    state: 'Palma',
    family_name: 'Parizzi',
    tfp: 'B2C_1_signupsignin1',
    user: null
  }
}
[next-auth][error][OAUTH_PARSE_PROFILE_ERROR] 
https://next-auth.js.org/errors#oauth_parse_profile_error Cannot read property '0' of undefined {
  error: {
    message: "Cannot read property '0' of undefined",
    stack: "TypeError: Cannot read property '0' of undefined\n" +
      '    at Object.profile (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\providers\\azure-ad-b2c.js:24:30)\n' +
      '    at getProfile (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\core\\lib\\oauth\\callback.js:161:36)\n' +
      '    at oAuthCallback (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\core\\lib\\oauth\\callback.js:131:33)\n' +
      '    at processTicksAndRejections (internal/process/task_queues.js:95:5)\n' +
      '    at async Object.callback (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\core\\routes\\callback.js:50:11)\n' +
      '    at async NextAuthHandler (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\core\\index.js:103:28)\n' +
      '    at async NextAuthNextHandler (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\next\\index.js:40:7)\n' +
      '    at async C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\next\\index.js:80:32\n' +
      '    at async Object.apiResolver (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next\\dist\\server\\api-utils.js:102:9)\n' +
      '    at async DevServer.handleApiRequest (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next\\dist\\server\\next-server.js:1017:9)',
    name: 'TypeError'
  },
  OAuthProfile: {
    exp: 1635524073,
    nbf: 1635520473,
    ver: '1.0',
    iss: 'https://dgpav2dev.b2clogin.com/bd51fb4d-a1b4-42b2-a322-3e8d6a829dd3/v2.0/',
    sub: 'bca5df8c-2d64-47df-bdc1-201bd5be8146',
    aud: '0d3c674a-8aaf-41c0-8bad-36ebf325f59d',
    iat: 1635520473,
    auth_time: 1635520471,
    oid: 'bca5df8c-2d64-47df-bdc1-201bd5be8146',
    newUser: true,
    country: 'Spain',
    given_name: 'Emiliano',
    state: 'Palma',
    family_name: 'Parizzi',
    tfp: 'B2C_1_signupsignin1',
    user: null
  },
  message: "Cannot read property '0' of undefined"
}
[next-auth][debug][OAUTH_CALLBACK_RESPONSE] {
  profile: null,
  account: null,
  OAuthProfile: {
    exp: 1635524073,
    nbf: 1635520473,
    ver: '1.0',
    iss: 'https://dgpav2dev.b2clogin.com/bd51fb4d-a1b4-42b2-a322-3e8d6a829dd3/v2.0/',
    sub: 'bca5df8c-2d64-47df-bdc1-201bd5be8146',
    aud: '0d3c674a-8aaf-41c0-8bad-36ebf325f59d',
    iat: 1635520473,
    auth_time: 1635520471,
    oid: 'bca5df8c-2d64-47df-bdc1-201bd5be8146',
    newUser: true,
    country: 'Spain',
    given_name: 'Emiliano',
    state: 'Palma',
    family_name: 'Parizzi',
    tfp: 'B2C_1_signupsignin1',
    user: null
  }
}
[next-auth][debug][OAUTH_CALLBACK_PROTECTION] {
  state: '18e7f650b6217557a54f8759c7f3f087a3df1b8d7b8c3d7a44c0831d060a9694',
  csrfToken: 'af9b2355283971f4ba4809f0c1e41fab417bc8cd1d50fb212ec30fa4a4afa051'
}
[next-auth][debug][GET_AUTHORIZATION_URL] {
  url: 'https://dgpav2dev.b2clogin.com/dgpav2dev.onmicrosoft.com/b2c_1_signupsignin1/oauth2/v2.0/authorize?client_id=0d3c674a-8aaf-41c0-8bad-36ebf325f59d&scope=offline_access%20openid&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fazure-ad-b2c&nextauth=signin%2Cazure-ad-b2c&state=18e7f650b6217557a54f8759c7f3f087a3df1b8d7b8c3d7a44c0831d060a9694'
}
[next-auth][debug][PROFILE_DATA] {
  OAuthProfile: {
    exp: 1635524313,
    nbf: 1635520713,
    ver: '1.0',
    iss: 'https://dgpav2dev.b2clogin.com/bd51fb4d-a1b4-42b2-a322-3e8d6a829dd3/v2.0/',
    sub: 'bca5df8c-2d64-47df-bdc1-201bd5be8146',
    aud: '0d3c674a-8aaf-41c0-8bad-36ebf325f59d',
    iat: 1635520713,
    auth_time: 1635520710,
    oid: 'bca5df8c-2d64-47df-bdc1-201bd5be8146',
    newUser: true,
    country: 'Spain',
    given_name: 'Emiliano',
    state: 'Palma',
    family_name: 'Parizzi',
    tfp: 'B2C_1_signupsignin1',
    user: null
  }
}
[next-auth][error][OAUTH_PARSE_PROFILE_ERROR] 
https://next-auth.js.org/errors#oauth_parse_profile_error Cannot read property '0' of undefined {
  error: {
    message: "Cannot read property '0' of undefined",
    stack: "TypeError: Cannot read property '0' of undefined\n" +
      '    at Object.profile (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\providers\\azure-ad-b2c.js:24:30)\n' +
      '    at getProfile (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\core\\lib\\oauth\\callback.js:161:36)\n' +
      '    at oAuthCallback (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\core\\lib\\oauth\\callback.js:131:33)\n' +
      '    at processTicksAndRejections (internal/process/task_queues.js:95:5)\n' +
      '    at async Object.callback (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\core\\routes\\callback.js:50:11)\n' +
      '    at async NextAuthHandler (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\core\\index.js:103:28)\n' +
      '    at async NextAuthNextHandler (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\next\\index.js:40:7)\n' +
      '    at async C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\next\\index.js:80:32\n' +
      '    at async Object.apiResolver (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next\\dist\\server\\api-utils.js:102:9)\n' +
      '    at async DevServer.handleApiRequest (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next\\dist\\server\\next-server.js:1017:9)',
    name: 'TypeError'
  },
  OAuthProfile: {
    exp: 1635524313,
    nbf: 1635520713,
    ver: '1.0',
    iss: 'https://dgpav2dev.b2clogin.com/bd51fb4d-a1b4-42b2-a322-3e8d6a829dd3/v2.0/',
    sub: 'bca5df8c-2d64-47df-bdc1-201bd5be8146',
    aud: '0d3c674a-8aaf-41c0-8bad-36ebf325f59d',
    iat: 1635520713,
    auth_time: 1635520710,
    oid: 'bca5df8c-2d64-47df-bdc1-201bd5be8146',
    newUser: true,
    country: 'Spain',
    given_name: 'Emiliano',
    state: 'Palma',
    family_name: 'Parizzi',
    tfp: 'B2C_1_signupsignin1',
    user: null
  },
  message: "Cannot read property '0' of undefined"
}
[next-auth][debug][OAUTH_CALLBACK_RESPONSE] {
  profile: null,
  account: null,
  OAuthProfile: {
    exp: 1635524313,
    nbf: 1635520713,
    ver: '1.0',
    iss: 'https://dgpav2dev.b2clogin.com/bd51fb4d-a1b4-42b2-a322-3e8d6a829dd3/v2.0/',
    sub: 'bca5df8c-2d64-47df-bdc1-201bd5be8146',
PS C:\Users\epari\Coding\next-auth-example> npm run dev

> next-auth-example@0.0.0 dev C:\Users\epari\Coding\next-auth-example
> next

ready - started server on 0.0.0.0:3000, url: http://localhost:3000
info  - Loaded env from C:\Users\epari\Coding\next-auth-example\.env.local
event - compiled successfully in 2.2s (190 modules)
warn  - using beta Middleware (not covered by semver) - https://nextjs.org/docs/messages/beta-middleware
wait  - compiling /_middleware (client only)...
event - compiled successfully in 371 ms (306 modules)
wait  - compiling /api/auth/[...nextauth] (server only)...
event - compiled successfully in 160 ms (318 modules)
[next-auth][debug][OAUTH_CALLBACK_PROTECTION] {
  state: '18e7f650b6217557a54f8759c7f3f087a3df1b8d7b8c3d7a44c0831d060a9694',   
  csrfToken: 'af9b2355283971f4ba4809f0c1e41fab417bc8cd1d50fb212ec30fa4a4afa051'
}
[next-auth][debug][GET_AUTHORIZATION_URL] {
  url: 'https://dgpav2dev.b2clogin.com/dgpav2dev.onmicrosoft.com/b2c_1_signupsignin1/oauth2/v2.0/authorize?client_id=0d3c674a-8aaf-41c0-8bad-36ebf325f59d&scope=offline_access%20openid&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fazure-ad-b2c&nextauth=signin%2Cazure-ad-b2c&state=18e7f650b6217557a54f8759c7f3f087a3df1b8d7b8c3d7a44c0831d060a9694'
}
[next-auth][error][OAUTH_CALLBACK_ERROR] 
https://next-auth.js.org/errors#oauth_callback_error JWT not active yet, now 1635520790, nbf 1635520791 {
  error: {
    message: 'JWT not active yet, now 1635520790, nbf 1635520791',
    stack: 'RPError: JWT not active yet, now 1635520790, nbf 1635520791\n' +
      '    at Client.validateJWT (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\openid-client\\lib\\client.js:888:15)\n' +
      '    at Client.validateIdToken (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\openid-client\\lib\\client.js:706:60)\n' +        
      '    at Client.callback (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\openid-client\\lib\\client.js:462:18)\n' +
      '    at processTicksAndRejections (internal/process/task_queues.js:95:5)\n' +
      '    at async oAuthCallback (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\core\\lib\\oauth\\callback.js:103:16)\n' +
      '    at async Object.callback (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\core\\routes\\callback.js:50:11)\n' +   
      '    at async NextAuthHandler (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\core\\index.js:103:28)\n' +
      '    at async NextAuthNextHandler (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\next\\index.js:40:7)\n' +
      '    at async C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next-auth\\next\\index.js:80:32\n' +
      '    at async Object.apiResolver (C:\\Users\\epari\\Coding\\next-auth-example\\node_modules\\next\\dist\\server\\api-utils.js:102:9)',       
    name: 'RPError'
  },
  providerId: 'azure-ad-b2c',
  message: 'JWT not active yet, now 1635520790, nbf 1635520791'
}
[next-auth][error][CALLBACK_OAUTH_ERROR] 
https://next-auth.js.org/errors#callback_oauth_error JWT not active yet, now 1635520790, nbf 1635520791 RPError: JWT not active yet, now 1635520790, nbf 1635520791        
    at Client.validateJWT (C:\Users\epari\Coding\next-auth-example\node_modules\openid-client\lib\client.js:888:15)
    at Client.validateIdToken (C:\Users\epari\Coding\next-auth-example\node_modules\openid-client\lib\client.js:706:60)
    at Client.callback (C:\Users\epari\Coding\next-auth-example\node_modules\openid-client\lib\client.js:462:18)
    at processTicksAndRejections (internal/process/task_queues.js:95:5)
    at async oAuthCallback (C:\Users\epari\Coding\next-auth-example\node_modules\next-auth\core\lib\oauth\callback.js:103:16)
    at async Object.callback (C:\Users\epari\Coding\next-auth-example\node_modules\next-auth\core\routes\callback.js:50:11)
    at async NextAuthHandler (C:\Users\epari\Coding\next-auth-example\node_modules\next-auth\core\index.js:103:28)
    at async NextAuthNextHandler (C:\Users\epari\Coding\next-auth-example\node_modules\next-auth\next\index.js:40:7)
    at async C:\Users\epari\Coding\next-auth-example\node_modules\next-auth\next\index.js:80:32
    at async Object.apiResolver (C:\Users\epari\Coding\next-auth-example\node_modules\next\dist\server\api-utils.js:102:9) {
  name: 'OAuthCallbackError'
}

It seems it cannot read the profile. What am I missing here?

Anyway, better documentation and examples would be highly appreciated.

How to reproduce ☕️

https://github.com/nextauthjs/next-auth-example.git

Contributing 🙌🏽

Yes, I am willing to help answer this question in a PR

Metadata

Metadata

Assignees

No one assigned

    Labels

    providersquestionAsk how to do something or how something works

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions